feat(dovecot): historical-account andriy.oblivantsev@wheregroup.com for wheregroup incubator (#252)

config/user-patches.sh

@@ -3,11 +3,18 @@
 # two owner classes (issue #79, issue #251 / epic #250):
 #   - production owners (ano@, andriy.oblivantsev@, postmaster@): read-only
 #     (`lookup read`) — one login in Roundcube covers the whole account list;
-#   - incubator owners (wheregroup@produktor.io; future sources like
-#     gmail_lenovo@, tb-*/pst-*): read + delete (`lookup read delete expunge
+#   - incubator owners: read + delete (`lookup read delete expunge
 #     write-deleted`) — the mailbox owner never logs in, mail is imported via
 #     doveadm; deleting a message in Roundcube = filter/exclusion from the
 #     corpus (autosync, epic B).
+# Incubator model (corrected 2026-09-02, issue #252): the incubator mailbox IS
+# the owner's HISTORICAL ADDRESS per period, not an abstract "source" mailbox.
+# The wheregroup period = andriy.oblivantsev@wheregroup.com; later periods get
+# their own account (eslider@gmail.com, ...@viscreation.de, ...).
+# wheregroup@produktor.io stays listed as the superseded A1 pilot box until
+# its 1000 messages are migrated and the account is deleted — grant_share
+# skips owners that are not (yet) in postfix-accounts.cf, so a deleted account
+# is a silent no-op.
 # DMS runs this only on the FIRST start of each container instance (plain
 # `docker compose restart` skips the setup step by design — /CONTAINER_START
 # marker), so it must stay idempotent. ACLs, the shared dict and subscriptions
@@ -31,7 +38,7 @@ chmod 0770 "${SHARED_DB_DIR}"
 #    when Roundcube moves a deleted message to Trash.
 READER='info@produktor.io'
 PRODUCTION_OWNERS='ano@produktor.io andriy.oblivantsev@produktor.io postmaster@produktor.io'
-INCUBATOR_OWNERS='wheregroup@produktor.io'
+INCUBATOR_OWNERS='andriy.oblivantsev@wheregroup.com wheregroup@produktor.io'
 
 grant_share() { # $1=owner, remaining=right names
   local owner=$1